import { UserRole, type SessionPermissions, type AllowedFeature } from '../types/token.types';
/**
 * TokenService handles sessionToken decoding and permission checking.
 *
 * This is a core utility (not a domain service) because:
 * - JWT decode logic is provider-agnostic
 * - No events or lifecycle management needed
 * - Used internally by Vroom.connect() and Session
 *
 * @example
 * ```typescript
 * const token = new TokenService(sessionToken)
 *
 * // Check feature availability
 * if (token.hasFeature('recording')) {
 *   // Recording is allowed
 * }
 *
 * // Check role
 * if (token.canModerate()) {
 *   // User is host or moderator
 * }
 * ```
 */
export declare class TokenService {
    private payload;
    private permissions;
    constructor(sessionToken: string);
    /**
     * Get all allowed features
     */
    getFeatures(): AllowedFeature[];
    /**
     * Check if a specific feature is allowed
     */
    hasFeature(feature: AllowedFeature): boolean;
    /**
     * Get user role
     */
    getRole(): UserRole;
    /**
     * Check if user has host role
     */
    isHost(): boolean;
    /**
     * Check if user has moderator role
     */
    isModerator(): boolean;
    /**
     * Check if user can moderate (host or moderator)
     */
    canModerate(): boolean;
    /**
     * Get full permissions object
     */
    getPermissions(): SessionPermissions;
    /**
     * Check if token is expired
     */
    isExpired(): boolean;
    /**
     * Decode JWT token (without verification)
     *
     * JWT structure: header.payload.signature
     * We only need the payload part which is base64url encoded
     */
    private decodeToken;
    /**
     * Base64URL decode (handles URL-safe base64)
     */
    private base64UrlDecode;
    /**
     * Extract permissions from token payload
     */
    private extractPermissions;
}
//# sourceMappingURL=token.d.ts.map